How to Freeze My Credit After a Data Breach

A credit freeze, also called a security freeze, stops most new creditors from opening your credit file. It is useful after a breach when a Social Security number, date of birth, or full identity packet may have been involved. It is less urgent when a notice lists only an email address and no government or financial identifiers, though you can still freeze as a precaution. A freeze does not:

Think of it as a lock on new borrowing in your name, not a full identity shield. Freeze or fraud alert? People searching how to freeze my credit after a data breach often get offered a fraud alert instead. They are different tools.

If identity theft is already confirmed and you have an FTC Identity Theft Report, an extended alert can last seven years. The CFPB notes that with an extended alert, a creditor must contact you before approving new credit. After a serious identity exposure, many people place the freeze and add an alert. After a lower-risk email-only notice, an alert plus monitoring may feel like enough. The FTC presents both as consumer tools, not as products you must buy.

There is no single button that freezes every U.S. file. You place three freezes. Use official bureau pages you type yourself. The FTC’s freeze explainer points consumers to the credit-report service areas for:

You will need to prove who you are to the bureau. Use a device you trust. Save the confirmation and any PIN or password the bureau gives you to lift the freeze later. Store that material in a password manager or a paper file you control — not in an email folder titled “PIN.” The CFPB summarizes timing rules that generally apply when you request a freeze by phone or a secure electronic form: the bureau must place it within one business day, send written confirmation within five business days, and honor a timely request to lift it. Mail requests take longer. If you also need reports, use AnnualCreditReport.com rather than a look-alike “free score” ad. The FTC says that site is the authorized source for the free reports the law provides.

A freeze is only frustrating when you forget it is there. Before you apply for credit, ask which bureau the lender will use. The FTC says you can lift only that bureau, then freeze it again when the check is done. If you do not know which bureau, lift all three for a short window. Lift requests made online or by phone are designed to move quickly. Plan the lift for the day of the application, not weeks later, and put the freeze back when the lender is finished. Tell a spouse or trusted family member where the lift credentials live if someone else may need to handle an emergency application. Do not post those credentials. Children can also have files frozen. The FTC has noted that unused files can sit unnoticed. If you manage a minor’s identity after a family breach notice, use the bureau’s official process for a protected consumer freeze rather than a random third-party form.

A freeze does not finish the notice.

IdentityTheft.gov/databreach remains the place to match the exposed data type to a federal checklist. A freeze is one box on that list when credit identifiers are in play. It is not a substitute for tax or medical steps if those records were also named.

The moment you search how to freeze my credit after a data breach, ads and calls try to sell a paid “lock” or a same-day specialist. Decline anyone who:

Place the freeze yourself. Report the pitch at ReportFraud.ftc.gov if money or personal data was requested.